sneak/smallwebwaf
1
0 Fork 0
Code Issues 13 Pull Requests 2 Actions 36 Packages Projects Releases Wiki Activity
Files
055876c7ed070d7fd0720a3edd9f43cd637db6fe
smallwebwaf/docs/image.md
T
clawbot 0cb6dded98
check / check (push) In progress
Details
Read every setting through viper and rename the settings (closes #211) 
Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)
2026-11-12 05:43:47 +01:00

1.6 KiB
Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. The image runs rproxy by default, or waf with SWW_COMMAND=waf. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Contents

  • Ubuntu 26.04 LTS, pinned by digest.
  • ca-certificates, nix-bin and runit from Ubuntu's archive.
  • Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
  • runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
  • The sww binary, and the user sww (uid and gid 65532).
  • The service directory /etc/service/sww, with the run script share/sww.run.
  • /var/lib/sww for waf's state files, and /etc/sww/rules.d with the default rule file share/rules.d/00-default.rules. The run script makes SWW_WAF_STATE_DIR when it is missing.
  • EXPOSE 8080, and the HEALTHCHECK that runs sww healthcheck.

Pins

  • Ubuntu's packages are not pinned: they come from the live archive, whose packages change with every update.
  • nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
  • runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
  • The Go image that builds sww: by digest.
Reference in new issue View Git Blame Copy Permalink